Privacy Policy

This Privacy Policy explains how h3-max.co ("h3-max.co," "we," "us," or "our") collects, uses, discloses, and protects information when you visit our website, create an account, purchase credits or a subscription, use our AI video generation features, access our API, or contact support (collectively, the "Services").

By using the Services, you acknowledge the practices described below. If you do not agree with this Policy, please do not use the Services.

1. Information We Collect

Information you provide

• Account information: your name, email address, profile image, authentication method, and account preferences.
• Generation content: prompts, uploaded images, audio or video, generation settings, references, and other material you submit, together with generated videos and related output.
• Billing information: plan or credit-pack selection, billing email, transaction status, amount, currency, invoice references, and payment-provider identifiers. Payment card details are collected and processed by Stripe or another payment provider and are not stored by us in full.
• Support information: messages, files, and other details you provide when contacting support or reporting a problem.
• API information: API-key identifiers, request metadata, idempotency values, and usage associated with your account. We store API keys in hashed form.

Information collected automatically

• Device and log information: IP address, browser and device type, operating system, user agent, approximate country, language, timestamps, requested pages, and security or diagnostic events.
• Usage information: feature interactions, generation status, model and provider used, credit usage, downloads, purchases, and subscription activity.
• Attribution information: referring domain, landing page, campaign parameters, advertising click identifiers, referral code, a randomly generated device identifier, and whether your device appears to be mobile or desktop.
• Cookies and similar technologies: session, security, language, attribution, analytics, advertising-measurement, and preference technologies as described below.

Information from third parties

If you sign in with Google, we receive the account information Google makes available with your permission, such as your name, email address, profile image, and provider account identifier. We may also receive transaction confirmations from payment providers and task status or output information from AI infrastructure providers.

2. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the Services.
• Authenticate users, secure accounts, prevent fraud and abuse, and enforce our policies.
• Process prompts and source media, create outputs, track generation status, and calculate or restore credits.
• Process purchases, subscriptions, invoices, cancellations, and payment-related support.
• Provide customer support and send transactional or service communications.
• Measure traffic, acquisition channels, conversion events, and product performance.
• Debug errors, monitor reliability, protect our infrastructure, and comply with legal obligations.
• Establish, exercise, or defend legal claims and protect users, third parties, and the public.

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you, comply with law, pursue legitimate interests such as security and service improvement, or based on your consent. You may withdraw consent where processing relies on consent, without affecting earlier lawful processing.

3. AI Inputs, Outputs, and Third-Party Processing

To generate media, we send the prompts, source files, generation settings, and related request data needed to fulfill your request to AI infrastructure providers, including fal.ai and the model providers available through it. These providers may process data in other countries and under their own terms and privacy policies.

We store generation records such as prompts, settings, provider task identifiers, status, credit cost, and output URLs so that we can deliver results, show task history, provide support, prevent abuse, and reconcile billing. Generated files or uploaded source media may be stored by our object-storage or AI infrastructure providers.

Do not submit confidential information, personal information about another person, or media you do not have the right and necessary consent to use. We do not use your content to train our own AI models unless we first obtain your explicit permission. We cannot control whether a third-party AI provider uses or retains data under its own published terms, so you should review the applicable provider terms before submitting sensitive material.

4. Cookies, Analytics, and Advertising Measurement

We use first-party cookies that are necessary for sign-in, session security, language selection, referral attribution, and core site operation. Our first-party attribution cookie may retain campaign, referral, approximate country, landing-page, and random device-identifier information for up to 90 days.

When enabled, Google Analytics and Google Ads help us understand site use and measure events such as sign-up, successful generation, checkout, and purchase. Google may receive information such as the page URL, IP address, browser or device information, advertising identifiers, and cookie data. Google may set or read its own cookies according to its policies and your Google settings.

We may also enable privacy analytics, session diagnostics, or customer-support tools such as Plausible, Microsoft Clarity, Crisp, or Tawk.to. If enabled, those services process information according to their own privacy notices.

You can manage or delete cookies through your browser, adjust Google advertising choices in My Ad Center, or use the Google Analytics opt-out add-on. Blocking necessary cookies may prevent sign-in or other features from working.

5. How We Share Information

We disclose information only as reasonably necessary for the purposes described in this Policy:

• Hosting and security: Cloudflare provides network, Worker, database, security, and related infrastructure.
• AI generation: fal.ai and model or infrastructure providers process prompts, source media, settings, and outputs needed to complete generation requests.
• Authentication and analytics: Google provides optional sign-in, One Tap, analytics, and advertising measurement.
• Payments: Stripe and its banking or payment partners process purchases, subscriptions, fraud checks, refunds, and billing support.
• Email, storage, and support: configured email, object-storage, and customer-support providers process data required to provide their services.
• Professional advisers and business transfers: advisers, auditors, insurers, acquirers, or successors where reasonably necessary and subject to appropriate confidentiality protections.
• Legal and safety reasons: authorities or other parties when required by law or when reasonably necessary to protect rights, safety, security, and the integrity of the Services.

We do not sell personal information for money. Some privacy laws may define the use of advertising or measurement technologies as "sharing," "sale," or "targeted advertising." Where those laws apply, you may contact us to exercise an applicable opt-out right.

6. Data Retention

We keep information only for as long as reasonably necessary to provide the Services and fulfill the purposes described here. Retention depends on the type of data:

• Account, generation, and support records are generally kept while your account is active and for a reasonable period afterward.
• Transaction, invoice, tax, fraud-prevention, and legal records may be kept longer where required by law or legitimate business needs.
• Session and security records expire or are removed according to their operational purpose.
• Deleted data may remain temporarily in backups, caches, logs, or third-party systems before being securely deleted or overwritten.

You may request account or content deletion as described below. We may retain limited information when required by law, needed to resolve disputes, prevent fraud, enforce agreements, or maintain an auditable record of transactions.

7. International Data Transfers

We and our service providers may process information in countries other than where you live. Those countries may have different data-protection laws. Where required, we use contractual or other legally recognized safeguards for international transfers.

8. Security

We use reasonable administrative, technical, and organizational safeguards, including encrypted transport, access controls, credential hashing, and restricted administrative access. No system is completely secure, and we cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur. You are responsible for protecting your password, API keys, account, and devices.

9. Your Choices and Privacy Rights

Depending on where you live, you may have rights to:

• Know or access the personal information we hold about you.
• Correct inaccurate information.
• Delete information, subject to lawful exceptions.
• Receive a portable copy of certain information.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of certain sales, sharing, targeted advertising, or marketing communications.
• Appeal a decision about a privacy request or complain to your local data-protection authority.

To exercise a right, email contact@h3-max.co from the address associated with your account. We may request information needed to verify your identity and authority. We will not discriminate against you for exercising an applicable privacy right.

10. Children's Privacy

The Services are not intended for anyone under 18 or below the age of legal majority where they live. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can investigate and take appropriate action.

11. Third-Party Links and Services

The Services may link to websites or services we do not control. Their privacy practices are governed by their own notices, and this Policy does not apply to them.

12. Changes to This Policy

We may update this Policy as the Services, providers, or legal requirements change. We will post the revised Policy and update the date above. If a change materially affects your rights, we will provide additional notice where reasonably practicable or legally required.

13. Contact Us

For privacy questions or requests, contact contact@h3-max.co. Please do not include payment card details, passwords, API keys, or other sensitive credentials in email.